alert ip any anyevent:                                                                                       -> any any (msg:"SURICATA Applatocol both direction"; flow:established; app-layer-event:                                          !                                 1                     t:.com"; _4;)